How can I find the version of tomcat bundled in Build Forge BEFORE I download and install it?
We want to find a version of Build Forge which contains a version of tomcat that contains fixes for specific vulnerabilities. We cannot find anything on the jazz.net Build Forge pages which itemises the version numbers for bundled products.
Where can we find this information please?
(The info was under "New and Noteworthy" for 7.1.3.4, but is not there for 7.1.3.4 iFix1 or for 7.1.3.5).
Related to this, is there a route yet for us to patch or upgrade tomcat in an existing Build Forge installation?
Thanks
David
3 answers
The tomcat is packaged with Build Forge but isn't integral in any way. You could easily install whatever other web application server you want, deploy the web applications to that server, and go from there. The buildforge.conf controls the database connection information and that is where all the persistent information is stored, so you can easily swap whatever web application server you need.
~Spencer
Hi David, The best way would probably be to use the compatibility matrix here:
http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity/index.jsp
http://pic.dhe.ibm.com/infocenter/prodguid/v1r0/clarity/index.jsp
Select the prerequisites radio button, and choose generate report and search for the version of Build Forge you are interested in. BF 7.1.3 lists Tomcat 5.5 and 7.
During the install, you are asked if you are providing your own appserver. This is where you would deviate from the "basic" install if you wanted to use a different version of tomcat. Typically every other release we update the backend tools (tomcat, apache, php) and the other releases are bugfix only. So the version listed in the new and noteworthy for 7.1.3.4 will be the same version for 7.1.3.5.
For the technote on replacing tomcat, that was done with tomcat 5.5 -> tomcat 7.0 in mind. The concepts are pretty much the same. The webapps and the server.xml are the big ones to move over. Though now I'm curious... which version of tomcat are you looking for and why?
Comments
Robert - we are probably looking for the latest tomcat that would be compatible with Build Forge 7.1.3.4. This is because we are mandated to comply with internal audit procedures which list versions of products which we are not permitted to use due to known vulnerabilities. Unfortunately the version of tomcat shipped with 7.1.3.4 is no longer compliant for us.
replacing the tomcat shipped with BF is not that hard. support has a known process (mentioned above) that basically consists of - move the old one out of the way, drop in the new one (same dir name), copy webapps and server.xml (and a couple of other conf files I don't have off the top of my head) and restart.
Tomcat is really pretty drop-in.
Tomcat in 7.1.3.5 is 7.0.26 we also updated the JVM to the IBM jdk 1.6 SR9. if that helps.
Replacing the 7.0.26 version with the 7.0.40 version (latest) or whichever your IT group requires should be rather simple. I would suggest you coordinate with support to get the procedure from them, and if you have any problems with it, I'd be happy to assist.
OK, thanks Robert.